Skip to content

Commit fc3a7ee

Browse files
akerlakerl
committed
add heracles
1 parent 505f567 commit fc3a7ee

File tree

4 files changed

+300
-13
lines changed

4 files changed

+300
-13
lines changed

‎configvault.tf

+1
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,6 @@ module "puppet-vault" {
2222
"proxy",
2323
"mqtt",
2424
"ledgerdb",
25+
"heracles",
2526
]
2627
}

‎servers.tf

+8
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,14 @@ module "metrics_validation" {
9090
zone_id = module.zones["a-rwx.org"].zone_id
9191
}
9292

93+
module "heracles_validation" {
94+
source = "armorfret/r53-certbot/aws"
95+
version = "0.6.4"
96+
admin_email = var.admin_email
97+
cert_name = "heracles.servers.home.a-rwx.org"
98+
zone_id = module.zones["a-rwx.org"].zone_id
99+
}
100+
93101
module "grafana_validation" {
94102
source = "armorfret/r53-certbot/aws"
95103
version = "0.6.4"

‎terraform.tfstate

+282-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": 4,
33
"terraform_version": "1.5.7",
4-
"serial": 12866,
4+
"serial": 12875,
55
"lineage": "6a6e3f47-d4c8-46eb-a34e-885062b7c62a",
66
"outputs": {
77
"domains": {
@@ -648,6 +648,7 @@
648648
"10.0.1.117": "cultivator.servers",
649649
"10.0.1.118": "unpoller.servers",
650650
"10.0.1.119": "mqtt.servers",
651+
"10.0.1.120": "heracles.servers",
651652
"10.0.1.150": "nas.servers",
652653
"10.0.1.80": "hass.servers",
653654
"10.0.1.91": "kiosk-office.servers",
@@ -800,6 +801,7 @@
800801
"10.0.1.117": "string",
801802
"10.0.1.118": "string",
802803
"10.0.1.119": "string",
804+
"10.0.1.120": "string",
803805
"10.0.1.150": "string",
804806
"10.0.1.80": "string",
805807
"10.0.1.91": "string",
@@ -5174,6 +5176,38 @@
51745176
"module.zones.aws_route53_zone.this"
51755177
]
51765178
},
5179+
{
5180+
"index_key": "10.0.1.120",
5181+
"schema_version": 2,
5182+
"attributes": {
5183+
"alias": [],
5184+
"allow_overwrite": null,
5185+
"cidr_routing_policy": [],
5186+
"failover_routing_policy": [],
5187+
"fqdn": "heracles.servers.home.a-rwx.org",
5188+
"geolocation_routing_policy": [],
5189+
"geoproximity_routing_policy": [],
5190+
"health_check_id": "",
5191+
"id": "Z06324102J3IVSSCKNZ4A_heracles.servers.home.a-rwx.org_A",
5192+
"latency_routing_policy": [],
5193+
"multivalue_answer_routing_policy": false,
5194+
"name": "heracles.servers.home.a-rwx.org",
5195+
"records": [
5196+
"10.0.1.120"
5197+
],
5198+
"set_identifier": "",
5199+
"ttl": 60,
5200+
"type": "A",
5201+
"weighted_routing_policy": [],
5202+
"zone_id": "Z06324102J3IVSSCKNZ4A"
5203+
},
5204+
"sensitive_attributes": [],
5205+
"private": "eyJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
5206+
"dependencies": [
5207+
"data.terraform_remote_state.unifi",
5208+
"module.zones.aws_route53_zone.this"
5209+
]
5210+
},
51775211
{
51785212
"index_key": "10.0.1.150",
51795213
"schema_version": 2,
@@ -25330,8 +25364,10 @@
2533025364
"sensitive_attributes": [],
2533125365
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDAsImRlbGV0ZSI6NjAwMDAwMDAwMDAwLCJ1cGRhdGUiOjYwMDAwMDAwMDAwMH19",
2533225366
"dependencies": [
25333-
"module.akerl-hook-site.module.apigw.module.lambda.aws_iam_role.lambda"
25334-
]
25367+
"module.akerl-hook-site.module.apigw.module.lambda.aws_iam_role.lambda",
25368+
"module.akerl-hook-site.module.apigw.module.lambda.data.aws_iam_policy_document.trust"
25369+
],
25370+
"create_before_destroy": true
2533525371
}
2533625372
]
2533725373
},
@@ -38178,6 +38214,201 @@
3817838214
}
3817938215
]
3818038216
},
38217+
{
38218+
"module": "module.heracles_validation",
38219+
"mode": "data",
38220+
"type": "aws_iam_policy_document",
38221+
"name": "certbot_validation",
38222+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
38223+
"instances": [
38224+
{
38225+
"schema_version": 0,
38226+
"attributes": {
38227+
"id": "2505638808",
38228+
"json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"route53:ListHostedZonesByName\",\n \"route53:ListHostedZones\",\n \"route53:GetChange\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"route53:ListResourceRecordSets\",\n \"route53:GetHostedZone\"\n ],\n \"Resource\": \"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": \"route53:ChangeResourceRecordSets\",\n \"Resource\": \"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\",\n \"Condition\": {\n \"ForAllValues:StringEquals\": {\n \"route53:ChangeResourceRecordSetsNormalizedRecordNames\": \"_acme-challenge.heracles.servers.home.a-rwx.org\"\n }\n }\n }\n ]\n}",
38229+
"minified_json": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"route53:ListHostedZonesByName\",\"route53:ListHostedZones\",\"route53:GetChange\"],\"Resource\":\"*\"},{\"Effect\":\"Allow\",\"Action\":[\"route53:ListResourceRecordSets\",\"route53:GetHostedZone\"],\"Resource\":\"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\"},{\"Effect\":\"Allow\",\"Action\":\"route53:ChangeResourceRecordSets\",\"Resource\":\"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\",\"Condition\":{\"ForAllValues:StringEquals\":{\"route53:ChangeResourceRecordSetsNormalizedRecordNames\":\"_acme-challenge.heracles.servers.home.a-rwx.org\"}}}]}",
38230+
"override_json": null,
38231+
"override_policy_documents": null,
38232+
"policy_id": null,
38233+
"source_json": null,
38234+
"source_policy_documents": null,
38235+
"statement": [
38236+
{
38237+
"actions": [
38238+
"route53:GetChange",
38239+
"route53:ListHostedZones",
38240+
"route53:ListHostedZonesByName"
38241+
],
38242+
"condition": [],
38243+
"effect": "Allow",
38244+
"not_actions": [],
38245+
"not_principals": [],
38246+
"not_resources": [],
38247+
"principals": [],
38248+
"resources": [
38249+
"*"
38250+
],
38251+
"sid": ""
38252+
},
38253+
{
38254+
"actions": [
38255+
"route53:GetHostedZone",
38256+
"route53:ListResourceRecordSets"
38257+
],
38258+
"condition": [],
38259+
"effect": "Allow",
38260+
"not_actions": [],
38261+
"not_principals": [],
38262+
"not_resources": [],
38263+
"principals": [],
38264+
"resources": [
38265+
"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A"
38266+
],
38267+
"sid": ""
38268+
},
38269+
{
38270+
"actions": [
38271+
"route53:ChangeResourceRecordSets"
38272+
],
38273+
"condition": [
38274+
{
38275+
"test": "ForAllValues:StringEquals",
38276+
"values": [
38277+
"_acme-challenge.heracles.servers.home.a-rwx.org"
38278+
],
38279+
"variable": "route53:ChangeResourceRecordSetsNormalizedRecordNames"
38280+
}
38281+
],
38282+
"effect": "Allow",
38283+
"not_actions": [],
38284+
"not_principals": [],
38285+
"not_resources": [],
38286+
"principals": [],
38287+
"resources": [
38288+
"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A"
38289+
],
38290+
"sid": ""
38291+
}
38292+
],
38293+
"version": "2012-10-17"
38294+
},
38295+
"sensitive_attributes": []
38296+
}
38297+
]
38298+
},
38299+
{
38300+
"module": "module.heracles_validation",
38301+
"mode": "managed",
38302+
"type": "aws_iam_user",
38303+
"name": "this",
38304+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
38305+
"instances": [
38306+
{
38307+
"schema_version": 0,
38308+
"attributes": {
38309+
"arn": "arn:aws:iam::764218738161:user/certbot_heracles.servers.home.a-rwx.org",
38310+
"force_destroy": false,
38311+
"id": "certbot_heracles.servers.home.a-rwx.org",
38312+
"name": "certbot_heracles.servers.home.a-rwx.org",
38313+
"path": "/",
38314+
"permissions_boundary": "",
38315+
"tags": null,
38316+
"tags_all": {},
38317+
"unique_id": "AIDA3D3X4QXY5553ZEJRS"
38318+
},
38319+
"sensitive_attributes": [],
38320+
"private": "bnVsbA=="
38321+
}
38322+
]
38323+
},
38324+
{
38325+
"module": "module.heracles_validation",
38326+
"mode": "managed",
38327+
"type": "aws_iam_user_policy",
38328+
"name": "this",
38329+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
38330+
"instances": [
38331+
{
38332+
"schema_version": 0,
38333+
"attributes": {
38334+
"id": "certbot_heracles.servers.home.a-rwx.org:certbot_heracles.servers.home.a-rwx.org",
38335+
"name": "certbot_heracles.servers.home.a-rwx.org",
38336+
"name_prefix": "",
38337+
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"route53:ListHostedZonesByName\",\"route53:ListHostedZones\",\"route53:GetChange\"],\"Effect\":\"Allow\",\"Resource\":\"*\"},{\"Action\":[\"route53:ListResourceRecordSets\",\"route53:GetHostedZone\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\"},{\"Action\":\"route53:ChangeResourceRecordSets\",\"Condition\":{\"ForAllValues:StringEquals\":{\"route53:ChangeResourceRecordSetsNormalizedRecordNames\":\"_acme-challenge.heracles.servers.home.a-rwx.org\"}},\"Effect\":\"Allow\",\"Resource\":\"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\"}]}",
38338+
"user": "certbot_heracles.servers.home.a-rwx.org"
38339+
},
38340+
"sensitive_attributes": [],
38341+
"private": "bnVsbA==",
38342+
"dependencies": [
38343+
"module.heracles_validation.aws_iam_user.this",
38344+
"module.heracles_validation.data.aws_iam_policy_document.certbot_validation"
38345+
]
38346+
}
38347+
]
38348+
},
38349+
{
38350+
"module": "module.heracles_validation",
38351+
"mode": "managed",
38352+
"type": "aws_route53_record",
38353+
"name": "caa",
38354+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
38355+
"instances": [
38356+
{
38357+
"schema_version": 2,
38358+
"attributes": {
38359+
"alias": [],
38360+
"allow_overwrite": null,
38361+
"cidr_routing_policy": [],
38362+
"failover_routing_policy": [],
38363+
"fqdn": "heracles.servers.home.a-rwx.org",
38364+
"geolocation_routing_policy": [],
38365+
"geoproximity_routing_policy": [],
38366+
"health_check_id": "",
38367+
"id": "Z06324102J3IVSSCKNZ4A_heracles.servers.home.a-rwx.org_CAA",
38368+
"latency_routing_policy": [],
38369+
"multivalue_answer_routing_policy": false,
38370+
"name": "heracles.servers.home.a-rwx.org",
38371+
"records": [
38372+
"0 iodef \"mailto:[email protected]\"",
38373+
"0 issue \"letsencrypt.org; validationmethods=dns-01\"",
38374+
"0 issuewild \";\""
38375+
],
38376+
"set_identifier": "",
38377+
"ttl": 60,
38378+
"type": "CAA",
38379+
"weighted_routing_policy": [],
38380+
"zone_id": "Z06324102J3IVSSCKNZ4A"
38381+
},
38382+
"sensitive_attributes": [],
38383+
"private": "eyJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
38384+
"dependencies": [
38385+
"module.zones.aws_route53_zone.this"
38386+
]
38387+
}
38388+
]
38389+
},
38390+
{
38391+
"module": "module.heracles_validation",
38392+
"mode": "managed",
38393+
"type": "awscreds_iam_access_key",
38394+
"name": "this",
38395+
"provider": "provider[\"registry.terraform.io/armorfret/awscreds\"]",
38396+
"instances": [
38397+
{
38398+
"schema_version": 0,
38399+
"attributes": {
38400+
"file": "creds/certbot_heracles.servers.home.a-rwx.org",
38401+
"id": "AKIA3D3X4QXYQ7OHAEVH",
38402+
"user": "certbot_heracles.servers.home.a-rwx.org"
38403+
},
38404+
"sensitive_attributes": [],
38405+
"private": "bnVsbA==",
38406+
"dependencies": [
38407+
"module.heracles_validation.aws_iam_user.this"
38408+
]
38409+
}
38410+
]
38411+
},
3818138412
{
3818238413
"module": "module.influxdb_validation",
3818338414
"mode": "data",
@@ -39756,6 +39987,23 @@
3975639987
"sensitive_attributes": [],
3975739988
"private": "bnVsbA=="
3975839989
},
39990+
{
39991+
"index_key": "puppet-heracles",
39992+
"schema_version": 0,
39993+
"attributes": {
39994+
"arn": "arn:aws:iam::764218738161:user/puppet-heracles",
39995+
"force_destroy": false,
39996+
"id": "puppet-heracles",
39997+
"name": "puppet-heracles",
39998+
"path": "/",
39999+
"permissions_boundary": "",
40000+
"tags": null,
40001+
"tags_all": {},
40002+
"unique_id": "AIDA3D3X4QXY4Y763IBI3"
40003+
},
40004+
"sensitive_attributes": [],
40005+
"private": "bnVsbA=="
40006+
},
3975940007
{
3976040008
"index_key": "puppet-host",
3976140009
"schema_version": 0,
@@ -40054,6 +40302,23 @@
4005440302
"module.puppet-vault.data.aws_iam_policy_document.path_permissions"
4005540303
]
4005640304
},
40305+
{
40306+
"index_key": "puppet-heracles",
40307+
"schema_version": 0,
40308+
"attributes": {
40309+
"id": "puppet-heracles:s3-path-permissions",
40310+
"name": "s3-path-permissions",
40311+
"name_prefix": "",
40312+
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:PutObject\",\"s3:GetObject\",\"s3:DeleteObject\"],\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::akerl-puppet/public/${aws:username}/*\",\"arn:aws:s3:::akerl-puppet/private/${aws:username}/*\"]},{\"Action\":\"s3:GetObject\",\"Effect\":\"Allow\",\"Resource\":\"arn:aws:s3:::akerl-puppet/public/*\"},{\"Action\":\"s3:ListBucket\",\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"public/*\",\"private/${aws:username}/*\"]}},\"Effect\":\"Allow\",\"Resource\":\"arn:aws:s3:::akerl-puppet\"}]}",
40313+
"user": "puppet-heracles"
40314+
},
40315+
"sensitive_attributes": [],
40316+
"private": "bnVsbA==",
40317+
"dependencies": [
40318+
"module.puppet-vault.aws_iam_user.servers",
40319+
"module.puppet-vault.data.aws_iam_policy_document.path_permissions"
40320+
]
40321+
},
4005740322
{
4005840323
"index_key": "puppet-host",
4005940324
"schema_version": 0,
@@ -40525,6 +40790,20 @@
4052540790
"module.puppet-vault.aws_iam_user.servers"
4052640791
]
4052740792
},
40793+
{
40794+
"index_key": "puppet-heracles",
40795+
"schema_version": 0,
40796+
"attributes": {
40797+
"file": "creds/puppet-heracles",
40798+
"id": "AKIA3D3X4QXYRJMHUUEQ",
40799+
"user": "puppet-heracles"
40800+
},
40801+
"sensitive_attributes": [],
40802+
"private": "bnVsbA==",
40803+
"dependencies": [
40804+
"module.puppet-vault.aws_iam_user.servers"
40805+
]
40806+
},
4052840807
{
4052940808
"index_key": "puppet-host",
4053040809
"schema_version": 0,

0 commit comments

Comments
 (0)